Internet Disruptions in Sudan

Emile Aben — Sep 26, 2013 12:15 PM
Significant Internet disruptions are happening in Sudan, possibly as a reaction to riots. We use RIPE NCC tools to get a better understanding of what is going on.

 

The latest we see in RIPEstat (see Figure 1) is that in the routing tables that we collect, five Sudanese networks (ASNs) are still visible that together announce a total of 21 IPv4 prefixes and two IPv6 prefixes. Before the outage, we saw six ASNs announcing a total of 2,122 IPv4 and two IPv6 prefixes.

SD From RIPEstatFigure 1: Sudanese routing table statistics

What Figure 1 also shows is that there were brief periods (twice around 20:00 UTC) where the situation appeared to return to normal.

Zooming in on the ASNs that were visible in routing (see Figure 2), it is clear that this wasn't a full Internet blackout, at least not at the routing level: At its lowest point (25-09-2013, 12:55 UTC) we still saw three ASNs (33788/KANARTEL, 36972/MNTSD and 37197/SUDREN) still announcing address space. The three ASNs that completely disappeared were 15706/SUDATEL, 36998/SDN-MOBITEL and 37211/VISIONVALLEY.  Sudatel (the incumbent telecom) started announcing a single IPv4 prefix again around 13:00 UTC (our data has five-minute granularity).SD from RIPEstat ASNzoom

Figure 2: Sudanese ASNs in the routing table over time

The large drop in routed IPv4 prefixes is almost completely due to SDN-Mobitel - before the outage we see 1,864 IPv4 prefixes, while at time of writing this we only see a single /24 IPv4 prefix (256 IPv4 addresses) announced from this network.

Visibility of a network in routing is far from equal to everybody in the network having Internet access, and it is interesting to correlate these events in routing to actual traffic coming into large content networks (Akamai and Google have publicly available indicators of volumes of traffic) at the macroscopic level.

Zooming in, we can see what happened in the SudREN network, the single network that we have a RIPE Atlas probe in.

SudREN is the national research and education network of Sudan. What we see in latency measurements (see Figure 3) from that network is that there are periods where the rest of the Internet cannot be reached. This happens twice before the disruptions that are seen in routing (roughly 10:30 to 11:00 UTC and again from 11:30 to 13:00 UTC). Apart from these brief outages, this data indicates that for this network Internet connectivity is not disrupted.

latency SDFigure 3: Latencies from SudREN to a target in Germany. Two brief disruptions before and after 12:00 UTC are visible.

We'll try to keep on top of things and report updates in this article if we find new and interesting information.

If you want to monitor the status of the routing table in Sudan yourself, please visit:

https://stat.ripe.net/SD#tabId=routing

We'll try to keep updating that as near to real time as possible.

 

UPDATE (2013-09-26 10:28 UTC): The last Sudanese AS that went missing from the routing table came back (around 10:00 UTC), and the number of IPv4 prefixes went up to normal levels again too (see Figure 4). Google's transparency report indicates traffic levels back to normal again around 10:00 UTC too.

Figure 4: Indications of the Sudanese networks returning to their pre-disruption state


UPDATE (2013-09-27 11:28 UTC): 
I heard from what I consider a reliable source that the ISPs in Sudan were ordered to "shutdown the Internet".

The data we collected supports that: During the disruption described above a large number of networks were not globally visible anymore while a much smaller footprint of address space remained. Most Autonomous Systems (ASes) did not disappear completely from the global routing tables we collect, so possibly these ISPs mostly kept their international connectivity and core infrastructure running, while not providing Internet services to their end-users. Our RIPE Atlas measurements also support this, because the vantage point we have in SudREN that retained Internet connectivity seems to be close to their core infrastructure. With the data collected it's not possible to see if the users connected via SudREN had Internet access or not.

Let's hope this doesn't happen again.

0 Comments

Add comment

You can add a comment by filling out the form below. Only plain text is possible. Web and email addresses will be transformed into clickable links. Comments are moderated so they won't appear immediately.

Navigation
Related Items
Increased Reach of RIPE Atlas Anchors

Increasing the reach of RIPE Atlas anchors is one of the highest priority goals of RIPE Atlas Team. ...

Proposing Making RIPE Atlas Data More Public

RIPE Atlas is now three years old, and is moving from a prototype to production service. Based on ...

Modifications to the IP Analyser to Reflect New Policy

We are in the process of implementing the policy regarding Post Depletion Adjustment of Procedures ...

RIPE Atlas: Improved Probe Pages

We've made it much easier to get an overview of the history and measurements for all the public ...

Visualising Bandwidth Capacity and Network Activity in RIPEstat Using M-Lab Data

As a result of the cooperation between the RIPE NCC and Measurement Lab (M-Lab), you can now ...

more ...